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Period for Reply 



A SHORTENED STATUTORY PERIOD FOR REPLY IS SET TO EXPIRE 3 MONTH(S) FROM 
THE MAILING DATE OF THIS COMMUNICATION. 

- Extensions of time may be available under the provisions of 37 CFR 1 .1 36(a}. In no event, however, may a reply be timely filed 
after SIX (6) MONTHS from the mailing date of this communication. 
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- Failure to reply within the set or extended period for reply will, by statute, cause the application to become ABANDONED (35 U.S.C. § 133). 
Any reply received by the Office later than three months after the mailing date of this communication, even if timely filed, may reduce any 
earned patent term adjustment. See 37 CFR 1.704(b). 

Status 

1)^ Responsive to connmunication(s) filed on 28 July 2004 . 
2a)^ This action is FINAL. 2b)n This action is non-final. 

3) D Since this application is in condition for allowance except for formal matters, prosecution as to the merits is 

closed in accordance with the practice under Ex parte Quayle, 1935 CD. 11, 453 O.G. 213. 

Disposition of Claims 

4) ^ Claim(s) 1-21 is/are pending in the application, 

4a) Of the above claim(s) is/are withdrawn from consideration. 

5) 0 Claim(s) is/are allowed. 

6) S Claim(s) 1-21 is/are rejected. 
?)□ Claim(s) is/are objected to. 

8) 0 Claim(s) are subject to restriction and/or election requirement. 

Application Papers 

9) n The specification is objected to by the Examiner. 

10) n The drawing(s) filed on is/are: a)n accepted or b)n objected to by the Examiner. 

Applicant may not request that any objection to the drawing(s) be held in abeyance. See 37 CFR 1 .85(a). 
Replacement drawing sheet(s) including the correction is required if the drawing(s) is objected to. See 37 CFR 1.121(d). 
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3. n Copies of the certified copies of the priority documents have been received in this National Stage 

application from the International Bureau (PCT Rule 17.2(a)). 
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DETAILED ACTION 
Remarks 

1 . In response to communications filed on July 28, 2004, claims 1-21 are 
presently pending in the application. 

Claim Rejections - 35 USC § 102 

2. The following is a quotation of the appropriate paragraphs of 35 
U.S.C. 102 that form the basis for the rejections under this section made in this 
Office action: 

A person shall be entitled to a patent unless - 

(e) the invention was described in (1) an application for patent, published under section 
122(b), by another filed in the United States before the invention by the applicant for patent or 
(2) a patent granted on an application for patent by another filed in the United States before 
the invention by the applicant for patent, except that an international application filed under 
the treaty defined in section 351(a) shall have the effects for purposes of this subsection of an 
application filed in the United States only if the international application designated the United 
states and was published under Article 21(2) of such treaty in the English language. 

3. Claims 1-21 are rejected under 35 U.S.C. 102(e) as being anticipated by 
Sziklai et al. (U.S. Patent No. 6.341,287). 

As to claim 1 , Sziklai et al. teaches a method for tracking custom 
computer application development profiles in a data processing system (See 
abstract, where "custom computer application" is read on "information on 
operations and requirements concerning an activity or area of business"; also 
see column 8, lines 60-65), the method comprising: 
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creating the profiles with a first database tool (See colunnn 8, lines 25-41 , 
lines 60-67; column 9, lines 1-3, where "profiles" is read on "business 
operations"; also see column 9, lines 13-19); 

gathering requirements of the profiles with a second database tool (See 
abstract; column 10, lines 24-33, where "disposal of hazardous waste in landfills" 
is used as an example of collecting profile data and regulations); 

tracking modifications of the profiles with a third database tool (See 
column 8, lines 65-67; column 9, lines 1-3; column 32, lines 24-34); 

allowing security and authorization users access to the profiles (See 
column 9, lines 13-19; column 14, lines 50-58; column 21, lines 65-67); and 

determining whether breaches in security of the data processing system 
has occurred in each phase of development of a computer application program 
(See abstract; column 9, lines 10-16; column 14, lines 50-62; column 21, lines 
65-67; column 33, lines 5-10; column 34, lines 1-4). 

As to claims 2, 9 and 16 Sziklai et al. teaches wherein in the step of 
tracking modifications of the profiles with a third database tool, the third database 
tool comprises a Profile Matrix, wherein the Profile Matrix comprises a data set 
(See column 13, lines 14-22; column 25, lines 56-67; column 26, lines 1-7); 
wherein the third database tool comprises a Profile Matrix, and wherein the 
Profile Matrix comprises a data set (See column 13, lines 14-22; column 25, lines 
56-67; column 26, lines 1-7); wherein the third database tool comprises a Profile 
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Matrix, and wherein the Profile Matrix comprises a data set (See column 13, lines 
14-22; column 25, lines 56-67; column 26. lines 1-7). 

As to claims 3, 10 and 17 Sziklai et al. teaches wherein in the step of 
tracking modifications of the profiles with a third database tool, the third database 
tool allows tracking capability of tasks required to gather and implement changes 
to the profiles (See abstract; column 7, lines 42-57; column 8, lines 25-41 ; 
column 9, lines 58-61); wherein the third database tool allows tracking capability 
of tasks required to gather and implement changes to the profiles (See abstract; 
column 7, lines 42-57; column 8, lines 25-41; column 9, lines 58-61); wherein in 
the method, the step of tracking modifications of the profiles with a third database 
tool allows tracking capability of tasks required to gather and implement changes 
to the profiles (See abstract; column 7, lines 42-57; column 8, lines 25-41; 
column 9, lines 58-61). 

As to claims 4. 1 1 and 18 Sziklai et al. teaches wherein in the step of 
gathering requirements of the profiles with a second database tool, the second 
database tool comprises a profile requirement worksheet, wherein the profile 
requirement worksheet identifies the data (See column 9, lines 32-40, where 
"worksheet" is read on "worklisf ; column 10, lines 47-53); wherein the second 
database tool comprises a profile requirement worksheet, and wherein the profile 
requirement worksheet identifies the data (See column 9. lines 32-40, where 
"worksheet" is read on "worklisf; column 10, lines 47-53); wherein the second 
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database tool comprises a profile requirement worksheet, and wherein the profile 
requirement worksheet identifies the data (See column 9, lines 32-40. where 
"worksheet" is read on "worklist"; column 10. lines 47-53). 

As to claims 5, 12 and 19 Sziklai et al. teaches wherein in the step of 
gathering requirements of the profiles with a second database tool, the second 
database tool further identifies authorization objects and field values of the profile 
requirement worksheet necessary to gather the requirements of the profiles (See 
column 11, lines 13-22, lines 28-30; column 21, lines 11-15); wherein the second 
database tool further identifies authorization objects and field values of the profile 
requirement worksheet necessary to gather the requirements of the profiles (See 
column 11, lines 13-22, lines 28-30; column 21, lines 11-15); wherein the second 
database tool further identifies authorization objects and field values of the profile 
requirement worksheet necessary to gather the requirements of the profiles (See 
column 11. lines 13-22, lines 28-30; column 21, lines 11-15). 

As to claims 6, 13 and 20 Sziklai et al. teaches wherein the step of 
creating the profiles with a first database tool further comprises editing the 
profiles (See column 19, lines 30-32; column 21, lines 21-23); wherein the first 
database tool edits the profiles (See column 19, lines 30-32; column 21 , lines 21- 
23); wherein in the method, the step of creating the profiles with a first database 
tool further comprises editing the profiles (See column 19, lines 30-32; column 
21, lines 21-23). 
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As to claims 7, 14 and 21 Sziklai et aL , teaches wherein in the step of 
creating the profiles with a first database tool, the first database tool comprises a 
security and authorization profile change request database, wherein the security 
and authorization profile change request database allows the authorization users 
and requestors an ability to view documented progress of queries of the profiles 
(See column 11, lines 36-42, where "authorization users and requestors" is read 
on "configuration user ";column 29. lines 63-64; column 30, lines 17-25); wherein 
the first database tool comprises a security and authorization profile change 
request database, and wherein the security and authorization profile change 
request database allows the authorization users and requestors an ability to view 
documented progress of queries of the profiles (See column 11, lines 36-42, 
where "authorization users and requestors" is read on "configuration user 
";column 29, lines 63-64; column 30, lines 17-25); wherein the first database tool 
comprises a security and authorization profile change request database, and 
wherein the security and authorization profile change request database allows 
the authorization users and requestors an ability to view documented progress of 
queries of the profiles (See column 11, lines 36-42, where "authorization users 
and requestors" is read on "configuration user ";column 29, lines 63-64; column 
30. lines 17-25). 



As to claim 8, Sziklai et al, . teaches a computer system executing a 
method for tracking custom computer application development profiles in a data 
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processing system (See abstract, where "custom computer application" is read 
on "information on operations and requirements concerning an activity or area of 
business"; also see column 8, lines 60-65), the system comprising: 

a first database tool (See abstract; column 32, lines 12-21; column 34, 
lines 5-8); 

a second database tool connected to the first database tool (See abstract; 
column 32, lines 24-31; column 34, lines 5-8); 

a third database tool connected to the first and second database tool (See 
abstract; column 32, lines 32-41; column 34, lines 5-8); 

a data bank connected to the first, second and third database tool (See 
abstract; column 34, lines 5-8); and 

a security and authorization interface connected to the data processing 
system (See column 9, lines 13-19; column 14, lines 50-58; column 21, lines 65- 
67). wherein the first database tool comprises a first set of protocols which create 
the profiles (See column 8, lines 25-41, lines 60-67; column 9, lines 1-3, where 
"profiles" is read on "business operations"; also see column 9, lines 13-19), 

wherein the second database tool comprises a second set of protocols 
which gather requirements of the profiles (See abstract; column 10, lines 24-33, 
where "disposal of hazardous waste in landfills" is used as an example of 
collecting profile data and regulations); 

wherein the third database tool comprises a third set of protocols which 
track modifications of the profiles (See column 8, lines 65-67; column 9, lines 1-3; 
column 32, lines 24-34); and 
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wherein the third database tool is adapted to determine whether breaches 
in security of the data processing system has occurred in each phase of 
development of a computer application program (See abstract; column 9, lines 
10-16; column 14, lines 50-62; column 21, lines 65-67; column 33, lines 5-10; 
column 34, lines 1-4). 

As to claim 15. Sziklai et aL . teaches a program storage device readable 
by machine, tangibly embodying a program of instructions executable by the 
machine to perform a method for tracking custom computer application 
development profiles in a data processing system (See abstract, where "custom 
computer application" is read on "information on operations and requirements 
concerning an activity or area of business"; also see column 8, lines 60-65), the 
method comprising: 

creating the profiles with a first database tool (See column 8, lines 25-41, 
lines 60-67; column 9, lines 1-3, where "profiles" is read on "business 
operations"; also see column 9, lines 13-19); 

gathering requirements of the profiles with a second database tool (See 
abstract; column 10, lines 24-33, where "disposal of hazardous waste in landfills" 
is used as an example of collecting profile data and regulations); 

tracking modifications of the profiles with a third database tool (See 
column 8, lines 65-67; column 9, lines 1-3; column 32, lines 24-34); 

allowing security and authorization users access to the profiles (See 
column 9, lines 13-19; column 14, lines 50-58; column 21, lines 65-67); and 
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determining whether breaches in security of the data processing system 
has occurred in each phase of development of a computer application program 
(See abstract; column 9, lines 10-16; column 14, lines 50-62; column 21, lines 
65-67; column 33, lines 5-10; column 34. lines 1-4). 

Response to Arguments 

4. Applicant's arguments filed on July 28, 2004, with respect to the rejected 
claims 1-21 have been fully considered but they are not found to be persuasive: 

In response to applicants' arguments regarding claims "1, 8, and 15, 
contain features, which are patentably distinguishable from the prior art 
references of record, and in particular Sziklai et al. Specifically, claims 1 and 15 
provide, '...wherein determining whether breaches in security of said data 
processing system has occurred in each phase of development of a computer 
application program"'. Sziklai et al. , teaches "unauthorized tampering" which can 
also be considered a "security breach", because when a "security breach" occurs 
it means an unauthorized person or event has occurred (See column 14, lines 
50-58). Although, Sziklai et al. , does not go into full detail of "determining 
security breaches" Sziklai et al. , does however, disclose "security concerns" and 
"other relevant security activities" which can include "determining security 
breaches". Furthermore, Sziklai et al. , discloses "system privileges" and "setting 
up user groups", which could be created to detect a "security breach" if an 
unauthorized "user group" tries to access the database. Therefore, independent 
claims 1, 8 and 15 stand rejected and dependent claims 2-7, 9-14 and 16-21 are 
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also rejected because they are dependent on reject independent claims 1 , 8 and 
15. 

Conclusion 

5. THIS ACTION IS MADE FINAL. Applicant is reminded of the extension of 
time policy as set forth in 37 CFR 1.136(a). 

A shortened statutory period for reply to this final action is set to expire 
THREE MONTHS from the mailing date of this action. In the event a first reply is 
filed within TWO MONTHS of the mailing date of this final action and the advisory 
action is not mailed until after the end of the THREE-MONTH shortened statutory 
period, then the shortened statutory period will expire on the date the advisory 
action is mailed, and any extension fee pursuant to 37 CFR 1 .136(a) will be 
calculated from the mailing date of the advisory action. In no event, however, will 
the statutory period for reply expire later than SIX MONTHS from the mailing 
date of this final action. 

6. Any inquiry concerning this communication or earlier communications from 
the examiner should be directed to Mellissa M. Chojnacki whose telephone 
number is (571) 272-4076. The examiner can normally be reached on 9:00am- 
5:30pm. 

If attempts to reach the examiner by telephone are unsuccessful, the 
examiner's supervisor, Dov Popovici can be reached on (571) 272-4083. The fax 
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phone number for the organization where this application or proceeding is 
assigned Is 703-872-9306. 

Information regarding the status of an application may be obtained from 
the Patent Application Information Retrieval (PAIR) system. Status information 
for published applications may be obtained from either Private PAIR or Public 
PAIR. Status information for unpublished applications Is available through 
Private PAIR only. For more information about the PAIR system, see http://pair- 
dlrect.uspto.gov. Should you have questions on access to the Private PAIR 
system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll- 
free). 



Mmc 

January 3, 2005 



^AM RIMELL 
PRIMARY EXAMINER 




